build: add npm run bump; parallel npm-publish approval

- scripts/bump-version.mjs (+ npm run bump): bumps root and all workspace
  package versions, updates examples' ^X.Y.0 dependency range on the root
  package (matters on major bumps), and refreshes package-lock so npm ci
  accepts the release PR.
- npm-publish.yml: all publish jobs now depend directly on [build, test]
  instead of chaining, so they enter "waiting for approval" together and a
  single Review-deployments click approves the lot. Prerelease versions
  (any X.Y.Z-…) publish under --tag beta so they don't take latest.
- CONTRIBUTING.md: release steps now use npm run bump.

Dropped from the original change: the workflow_dispatch release.yml
(required a long-lived PAT to cascade events), label-based
.github/release.yml auto-notes (PRs aren't labeled today), and the
release-X.Y npm-tag for non-main branches (no backport branches yet).

Author: ochafik

.github/release.yml

@@ -142,11 +142,8 @@ jobs:
         id: npm-tag
         run: |
           VERSION=$(node -p "require('./package.json').version")
-          if [[ "$VERSION" == *"-beta"* ]]; then
+          if [[ "$VERSION" == *"-"* ]]; then
             echo "tag=--tag beta" >> $GITHUB_OUTPUT
-          elif [[ "${{ github.event.release.target_commitish }}" != "main" ]]; then
-            MAJOR_MINOR=$(echo "$VERSION" | cut -d. -f1,2)
-            echo "tag=--tag release-${MAJOR_MINOR}" >> $GITHUB_OUTPUT
           else
             echo "tag=" >> $GITHUB_OUTPUT
           fi
@@ -159,6 +156,7 @@ jobs:
   publish-mcpb:
     runs-on: ubuntu-latest
     if: github.event_name == 'release'
+    environment: Release
     needs: [build, test]
 
     permissions:

.github/workflows/npm-publish.yml

@@ -537,39 +537,19 @@ Before publishing releases, ensure the following are configured:
    - Name it `Release`
    - Add required reviewers or other protection rules as needed
 
-3. **`RELEASE_TOKEN` secret**: The release workflow creates GitHub Releases that must trigger the npm-publish workflow. Events from the default `GITHUB_TOKEN` don't cascade to other workflows, so a separate token is needed.
-   - Create a [fine-grained PAT](https://github.com/settings/personal-access-tokens/new) scoped to this repository with **Contents: write** permission
-   - Go to Settings > Secrets and variables > Actions > New repository secret
-   - Name: `RELEASE_TOKEN`, value: the PAT
-
 ### Publishing a Release
 
-Releases are automated via the [Release workflow](https://github.com/modelcontextprotocol/ext-apps/actions/workflows/release.yml).
-
-#### Steps to publish:
-
-1. **Trigger the Release workflow**:
-   - Go to Actions → [Release](https://github.com/modelcontextprotocol/ext-apps/actions/workflows/release.yml) → "Run workflow"
-   - Select the bump type (`patch`, `minor`, `major`, or `prerelease`)
-   - Click "Run workflow"
-
-2. **Review the release PR**:
-   - The workflow bumps the version across all packages and opens a PR labeled `release`
-   - Add release notes to `RELEASES.md` in the PR
-   - Approve and merge the PR
-   - _Note: re-running the workflow for the same version fails if the branch already exists. Delete the `release/vX.Y.Z` branch first if you need to redo the bump._
+1. **Bump the version** across the root and all workspace packages:
 
-3. **Done** — merging the PR automatically tags the commit and creates the GitHub Release (with auto-generated notes), which triggers the [npm-publish workflow](https://github.com/modelcontextprotocol/ext-apps/actions/workflows/npm-publish.yml). Approve the deployment once when prompted.
+   ```bash
+   npm run bump -- minor   # or: patch | major | prerelease --preid=beta | 1.7.0
+   ```
 
-#### Manual alternative
+   Commit and open a PR with a grouped changelog in the body (see prior `chore: bump …` PRs for the format).
 
-You can also bump versions locally:
-
-```bash
-npm run bump -- patch   # or: minor | major | prerelease --preid=beta
-```
+2. **Merge the PR**, then [draft a GitHub Release](https://github.com/modelcontextprotocol/ext-apps/releases/new) — create a `vX.Y.Z` tag on `main`, paste the changelog, publish.
 
-Then commit, push, and create a GitHub Release manually — the npm-publish workflow triggers on release creation.
+3. **Approve the deployment** — publishing the Release triggers the [npm-publish workflow](https://github.com/modelcontextprotocol/ext-apps/actions/workflows/npm-publish.yml); all publish jobs wait together for a single "Review deployments" approval.
 
 #### npm Tags